[13624] in bugtraq
Re: Disable Parent Paths
daemon@ATHENA.MIT.EDU (Justin King)
Tue Feb 1 13:51:47 2000
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Message-Id: <81D7AF647CE8D211A53A00805F9FACFB50D670@WATERTOWER>
Date: Mon, 31 Jan 2000 15:39:23 -0500
Reply-To: Justin King <JKing@GFPGROUP.COM>
From: Justin King <JKing@GFPGROUP.COM>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Some web developers call MapPath on form input to find out where to get/save
files... allowing Parent Paths could mean an unauthorized file viewage or
overwrite.
-Justin
-----Original Message-----
From: Robert Zachary [mailto:RZacha1@TANDY.COM]
Sent: Monday, January 31, 2000 10:38 AM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Disable Parent Paths
Writing a new IIS policy :
summary: Parent Paths allows you to use '..' in calls to MapPath and the
like. By default this option is enabled and should be disabled. To disable
this option go to the root of the Web site in question, right click select
Properties | Home Directory | Configuration | App Options and uncheck Enable
Parent Paths.
my question: What security hole/hack does this create if left enabled?.
Rob
